[Security] Bump redcarpet from 2.1.1 to 3.2.3

[dependabot-preview]

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

---

Bumps redcarpet from 2.1.1 to 3.2.3. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

redcarpet Gem for Ruby markdown.c parse_inline() Function XSS
redcarpet Gem for Ruby contains a flaw that allows a cross-site scripting
(XSS) attack. This flaw exists because the parse_inline() function in
markdown.c does not validate input before returning it to users. This may
allow a remote attacker to create a specially crafted request that would
execute arbitrary script code in a user's browser session within the trust
relationship between their browser and the server.

Patched versions: >= 3.2.3
Unaffected versions: none

Release notes

Sourced from redcarpet's releases.

Redcarpet 3.2.3

This release of Redcarpet fixes a security issue relying on auto-linking by preventing any rewinding of a previous inline like an emphasis when auto-linking another one like an e-mail address.

Also this release ships with a fix when escaping forward slashes with the Safe render object (there was a missing semi-colon).

Redcarpet 3.2.2

This release of Redcarpet is another patch release for the 3.2 series that addresses a regression that would wrap<script> tags inside paragraphs. See vmg/redcarpet#440 for further details.

Redcarpet 3.2.1

This release of Redcarpet is meant to address a backward incompatibility between version 3.1 and 3.2. Since the RedCloth API layer has been deprecated, the RedcarpetCompat class has been wrongly moved to the redcarpet/compat file but the class wasn't available when the file wasn't explicitly required.

This version fixes this requiring that file by default when Redcarpet gets loaded.

Redcarpet 3.2.0

Redcarpet v3.2.0

New features

Updates to the StripDown render

The StripDown render object will now handle images and correctly display links' URL. For instance:

Here's a ![squirrel](https://github.com/vmg/redcarpet/blob/HEAD/shipit.png) !

And an external [link](https://github.com).

Will now render to:

Here's a squirrel shipit.png !

And an external link (https://github.com) !

Introducing the Safe render

In order to safely deal with users' input for instance, Redcarpet now ships with a Redcarpet::Render::Safe object.

The :safe_links_only and :escape_html options are turned on by default. It also has a custom block_code callback since by default the specified language will be set as the class of the rendered code block.

Redcarpet::Markdown.new(Redcarpet::Render::Safe)

HTML5 block-level elements recognition

HTML5 blocks-level elements are now recognized so that they will not be included under a paragraph.

... (truncated)

Changelog

Sourced from redcarpet's changelog.

Version 3.2.3

• Avoid rewinding content of a previous inline when autolinking is
  enabled.

  Daniel LeCheminant

• Fix escaping of forward slashes with the Safe render object (add a
  missing semi-colon).

Version 3.2.2

• Consider script as a block-level element so it doesn't get included
  inside a paragraph.

Version 3.2.1

• Load RedcarpetCompat when requiring Redcarpet for the sake of
  backward compatibility.

  Loren Segal

Version 3.2.0

• Add a Safe renderer to deal with users' input. The escape_html
  and safe_links_only options are turned on by default.

  Moreover, the block_code callback removes the tag's class since
  the user can basically set anything with the vanilla one.

  Robin Dupret

• HTML5 block-level tags are now recognized

  silverhammermba

• The StripDown render object now displays the URL of links
  along with the text.

  Robin Dupret

• The RedCloth API compatibility layer is now deprecated.

  Robin Dupret

• A hyphen and an equal should not be converted to heading.

  namusyaka

• Fix emphasis character escape sequence detection while mid-emphasis.

... (truncated)

Commits

• c56a6d6 Redcarpet v3.2.3
• e5a1051 Avoid rewinding previous inline when auto-linking
• 7e9ba24 Fix escaping of slashes with the Safe render
• 733284f Redcarpet v3.2.2
• e6e1530 Consider the script tag as a block-level element
• ba200e3 Redcarpet v3.2.1
• 89f5330 Load RedcarpetCompat when requiring 'redcarpet'
• 873ae35 Redcarpet v3.2.0
• 7312c25 Switch the arguments order of assert_renders
• 5dad831 Move assert_renders to Redcarpet::TestCase
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.